General
-
Target
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe
-
Size
573KB
-
Sample
240508-qnyssshb28
-
MD5
90d93d073d92e1cd47f4d792f430bbbc
-
SHA1
3e4fe2f29722803551c31fe38aa04d97ec9150e7
-
SHA256
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb
-
SHA512
bd1daa7f963319f40e59c27870737f43e61e087c20cc0c3605a23910eb3a3a1aa27384f2c041d2a12bb1aed35adaabad6f7b797fbdd61acd5dde181046441481
-
SSDEEP
12288:rccadOGEW1ivxTRRSXyXQjDYq7C+5bLTTrBGZKGYC1DrJh6xjfHBB778Q6:IWGEW16TRRSKcAGbzrB4SC1DrJ0ZJB
Static task
static1
Behavioral task
behavioral1
Sample
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe
Resource
win7-20240221-en
Malware Config
Extracted
formbook
4.1
fs83
blastol.space
tomwalkerisfalco.com
us-sumatrraslimbellytonic.com
drywallandpaintingservice.com
vntapp.net
passportpages.site
at-mim.com
yeondagoods.com
teomanyildirim.com
paygame.site
senze.art
alhandco.com
9831bsej.xyz
traumatic.xyz
sos-soutien.com
thetechnolgy.live
washing-machine-46612.bond
marvsneakers.com
shequbaike.net
xc4f35fg4h35fg4h53.top
587659.com
mydiamondsea.com
purifyelements.com
key-royalty.com
aimuzil.fun
ykautomotives.com
naelm.xyz
memejseventhall.com
opensource.beer
whiskersfood.com
piedrajuansebastian.net
q3cts.baby
wdfa.xyz
marketfield.shop
id91920.com
22yorkwood.com
sogracefully.net
nodoubt2025tour.com
042024b.vip
fmegsw.com
zsqd4i.com
clashfitness.com
matrixtech.biz
ketoxiamejaworks.buzz
ariostech.com
cardingforum.co
comicdesk.xyz
johnsonforchair.com
mpower-recruitment.com
essenceemporium.us
die-mosaik.schule
saturnp.com
tophotoffers.com
rosamorflorerialima.com
askhelpsecur.us
lifestyledbymodigital.com
clintforcouncil2021.com
king1122.com
veterinariaconvet.com.co
jackandthebox.net
donderbosgames.com
wszy.site
off7979.com
justklip.com
buywestlakevillagehomes.com
Targets
-
-
Target
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe
-
Size
573KB
-
MD5
90d93d073d92e1cd47f4d792f430bbbc
-
SHA1
3e4fe2f29722803551c31fe38aa04d97ec9150e7
-
SHA256
eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb
-
SHA512
bd1daa7f963319f40e59c27870737f43e61e087c20cc0c3605a23910eb3a3a1aa27384f2c041d2a12bb1aed35adaabad6f7b797fbdd61acd5dde181046441481
-
SSDEEP
12288:rccadOGEW1ivxTRRSXyXQjDYq7C+5bLTTrBGZKGYC1DrJh6xjfHBB778Q6:IWGEW16TRRSKcAGbzrB4SC1DrJ0ZJB
-
Formbook payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-